Threat Intelligence¶

September 18, 2026
in Threat Intelligence
4 min read

Dissecting NxtGen mParivahan: An Android Banking Trojan Impersonating India's Vehicle Registration Portal (Part 1 — Dropper Analysis)

A GitHub repository, maparivahana/parivahansewaa, is being used to distribute an Android banking trojan that impersonates NextGen mParivahan, the official vehicle registration / eChallan app of India's Ministry of Road Transport and Highways (MoRTH). This is Part 1 of a three-part writeup covering our analysis: the phishing vector, the first-stage dropper, and the anti-analysis and Play Protect evasion tricks it uses.

September 18, 2026
in Threat Intelligence
4 min read

From Encrypted Blob to Trojan: Decrypting the mParivahan Dropper's Payload (Part 2)

In Part 1 we covered the parivahansewaa.apk dropper's phishing vector, anti-analysis tricks, and its VPN-sinkhole trick for blinding Google Play Protect. This part covers how its encrypted second-stage payload is decrypted, and what the resulting trojan — spoofing the package name com.transport.gov.in — actually does once it's running.

September 18, 2026
in Threat Intelligence
3 min read

Inside a 24-Repo Malware Network: Infrastructure and Dynamic C2 (Part 3)

Parts 1 and 2 covered a single repository's dropper and trojan payload. It turns out that repository is one of 24 under the same GitHub account, all distributing variants of the same Android banking trojan and sharing one backend. This part covers the wider campaign, the dynamic C2 failover mechanism, and a consolidated IOC list.